DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

ETH Can Be Sent but Never Withdrawn (Locked Funds)

cryptostellar5

Root + Impact

Description

The LikeRegistry.sol contract accepts ETH via receive(), but no function exists to withdraw or account for this ETH, permanently locking funds.

@> receive() external payable {}

Risk

Likelihood:

  • Anyone can send ETH directly

  • ETH bypasses fee accounting

  • No withdrawal function for non-fee ETH

Impact:

  • ETH is permanently locked

  • Treasury/accounting mismatch

Proof of Concept

There is no way to withdraw the ETH

function testReceiveLocksETH() public {
vm.deal(address(this), 1 ether);
(bool ok,) = address(likeregistry).call{value: 1 ether}("");
assertTrue(ok);
​
// No way to withdraw this ETH
}

Recommended Mitigation

  • Remove receive() unless required

  • Track all ETH inflows

- receive() external payable {}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!